# The safety model: what agents can do on Aria

> How Aria keeps Aria AI and coding agents safe: Look runs straight away, Change can wait for you, Delete needs the typed name. The tools an agent gets.

Source: https://getaria.cloud/docs/mcp (updated 1 November 2026)

Aria sorts everything an AI can ask for into three kinds. **Look** runs straight away. **Change** may wait for your approval, depending on the key and on what it changes. **Delete** always waits, and you must type the name of what you are deleting. Aria enforces this on its servers, not in a prompt, so an agent cannot talk its way past it.

The same rules apply to [Aria AI](https://getaria.cloud/docs/aria-ai) and to every coding agent over MCP. For Aria AI, every Change waits for you, apart from its own notes and drafting `aria.yaml` on the setup page.

## What are Look, Change and Delete?

| Kind | Examples | What happens |
|---|---|---|
| **Look** | Read the status, logs, metrics, `aria.yaml`, the database schema. Check a stack file. | Runs straight away. Nothing changes. |
| **Change** | Save `aria.yaml`, deploy a service, set variables, launch the app, run a read-only query. | Runs or waits, depending on the key and the change. See the next section. |
| **Delete** | Run SQL that changes a database, delete or restore over data. | Always waits for your approval in Aria. You type the exact name to confirm. |

## When does a Change wait for me?

It depends on what the key may do.

- With a **read-only** key, every Change waits for your approval.
- With a key that may **operate** the app, routine Changes run straight away. Saving `aria.yaml` and deploying a service are examples.
- **Environment variables, launching the whole app, DNS records and GitHub push always wait for you**, whatever the key.

Everything that waits shows up as a card in **AI & MCP**, then **Approvals**, with the exact change it will make. Nothing has changed until you approve. Decline it, and nothing ever will. The agent is told the request is waiting and checks on it with the `get_approval_status` tool. It is told not to ask again to get around you.

## How does Delete work?

Delete is the strictest kind. It never runs without a person. The approval card names what will be deleted and asks you to type that name before the button works. A terminal session cannot approve it either: a typed confirmation in a terminal is not enough, because an agent can type too. The person has to approve it in the Aria app or on the website.

## What does an agent never get?

- **Secret values.** Results and errors that go back to an agent have your secrets masked, even inside logs. Agents ask you for values with `request_env_values` and you enter them yourself. Revealing a secret always waits for you.
- **Passwords for your databases.** Database tools run as a limited role. Reading is read-only, and columns that look like credentials, such as `password`, `token` or `secret`, cannot be read.
- **Anything outside its key.** A key for one project cannot reach another project.

Text in logs, test emails and repository files was written by someone else. Aria tells agents to treat it as data, never as instructions.

## What is recorded?

Every call an agent makes through MCP is recorded in your project's Activity: who, what, when and the result. You can see which agent did what, and revoke a key at any time under **AI & MCP**. A revoked key is refused on its next call.

## Which tools does an agent get?

These tools are on the app address `https://api.getaria.cloud/mcp/w/<app id>`. Your agent sees their descriptions when it connects.

| Tool | Kind | What it does |
|---|---|---|
| `get_workspace` | Look | The app's details and status. |
| `get_app_overview` | Look | The app at a glance: status, addresses, deployments, and what needs you. |
| `get_app_metrics` | Look | Uptime, requests, errors and latency. |
| `get_logs` | Look | Recent output of a running service, with secrets masked. |
| `diagnose_app` | Look | Collects evidence and suggests ranked fixes. |
| `get_operation` | Look | The live status of a long task, step by step. |
| `get_approval_status` | Look | Whether an approval is still waiting, approved or declined. |
| `get_stack_prompt` | Look | The instructions for writing `aria.yaml` for this app. |
| `get_repo_skill` | Look | The Aria skill for your repository. |
| `validate_stack_file` | Look | Checks an `aria.yaml` and returns problems and warnings with line numbers. |
| `preview_launch` | Look | What launching would create, whether it fits the plan, and what blocks it. |
| `request_env_values` | Look | Tells you which secrets are needed. It never sees them. |
| `db_schema` | Look | Tables, columns, indexes and keys. |
| `submit_stack_file` | Change | Saves `aria.yaml`. |
| `db_query` | Change | Runs one read-only SQL query and returns at most 500 rows. |
| `set_env_vars` | Change, always waits | Sets variables. |
| `launch_workspace` | Change, always waits | Applies `aria.yaml`: creates the databases and services. |
| `db_migrate` | Delete, always waits | Runs SQL that changes a database. Runs once, in one transaction. |

The connection that covers every project in your workspace also offers tools such as `get_infrastructure_summary` and `deploy_app`, which builds and deploys the latest code of a project's branch.

## Where do I start with a coding agent?

The overview for people choosing a tool is [Let your coding agent deploy](https://getaria.cloud/agents). Each tool has its own workflow page: [Claude Code](https://getaria.cloud/claude-code), [Cursor](https://getaria.cloud/cursor) and [Codex](https://getaria.cloud/codex).

## What should I do if an agent behaves badly?

1. Open **AI & MCP** and revoke its key. It is refused on its next call.
2. Look at Activity for what it did.
3. Make a new key with fewer capabilities. See [Connect a coding agent](https://getaria.cloud/docs/agents).

Next: [Memory: what Aria knows about your project](https://getaria.cloud/docs/memory)